The Medicaid Ensuring Access to Medicaid Services final rule is no longer simply a 2024 regulatory development to be read and filed. Its Home- and Community-Based Services provisions are moving through a multi-year implementation sequence that reaches into person-centered planning, grievances, incident management, access measurement, quality reporting, workforce compensation and public accountability. For organizations following the wider legal, rights and regulatory framework affecting community-based services, the important question is increasingly not what the Access Rule says in principle, but whether state and provider infrastructure will be capable of producing the evidence it requires.
The rule matters particularly because it attempts to make Medicaid-funded Home- and Community-Based Services more observable. A service may be authorized on paper while starting late, authorized hours may remain undelivered, a critical incident may move slowly between agencies, or a person-centered plan may be technically present without being updated when needs change. The new framework increasingly asks states to measure what actually happens between authorization and delivery.
That creates a substantial regulatory compliance and accountability challenge, but also an opportunity. Better access intelligence could help states identify workforce shortages, provider-capacity problems and geographic disparities earlier. Better incident systems could expose recurring risks across programs. Greater payment transparency could create a clearer relationship between Medicaid funding and the direct-care workforce. None of those outcomes will arise from reporting alone. They depend on the quality of the underlying operational systems.
The Access Rule Is a Phased Program of Change, Not a Single Compliance Date
The Access Rule became effective on July 9, 2024, but its HCBS requirements were deliberately assigned different applicability dates. That distinction is essential. Treating the rule as either fully implemented or something that does not matter until 2030 would be equally misleading.
By 2026, implementation has also demonstrated why providers should follow current CMS direction rather than relying only on the timetable published when the final rule appeared. Fee-for-service HCBS grievance-system requirements were originally applicable beginning July 9, 2026. In February 2026, however, CMS announced that it did not anticipate taking enforcement action against states concerning those requirements through December 31, 2027. The underlying regulatory requirements remain important; the enforcement discretion gives states additional implementation time.
The next major stage arrives in 2027. Requirements scheduled around this stage include strengthened person-centered planning reporting, incident-management standards and critical-incident performance reporting, waiver waiting-list and service-access reporting, payment-adequacy reporting readiness and associated public transparency. HCBS Quality Measure Set reporting begins in 2028, as does reporting on the percentage of certain Medicaid HCBS payments spent on direct-care worker compensation. Electronic incident-management system requirements follow in 2029. The widely discussed 80% direct-care compensation minimum performance requirement is scheduled to apply beginning July 9, 2030, subject to the rule's defined flexibilities and exemptions.
This sequencing should change organizational behavior. A state cannot create reliable 2027 access reporting in mid-2027 if provider systems have never consistently distinguished authorized hours from delivered hours. A provider cannot suddenly explain its direct-care compensation percentage in 2028 if its accounting architecture has never been designed to classify the relevant Medicaid payments and compensation consistently. Preparation therefore needs to precede applicability.
State agencies and providers can use a structured readiness review rather than treating each date as an isolated compliance project. The Regulatory Readiness Gap Analyzer can support that process by helping organizations map requirements against existing controls, evidence, ownership and gaps. The value lies less in producing another checklist than in identifying where formal policy and operational capability diverge.
Grievances Should Become an Intelligence Source, Not Another Complaint Inbox
The fee-for-service grievance provisions are important because they give beneficiaries a defined route to raise dissatisfaction concerning the performance of person-centered planning, service-plan requirements and HCBS settings requirements. They apply within specified FFS HCBS authorities rather than replacing the established Medicaid managed-care grievance and appeal architecture.
The 2026 enforcement-discretion announcement creates additional implementation space, but it should not be interpreted as a reason to stop preparation. States still need to determine how people will submit grievances, how authorized representatives and other chosen supporters can assist them, how records will be maintained, how resolution timeframes will be controlled and how grievance information will feed into wider monitoring.
Providers have a parallel challenge. A state-level grievance process can reveal patterns that are invisible when organizations treat every complaint locally. Repeated concerns about community access, service-plan implementation, privacy, choice, restrictions or missed support may indicate more than dissatisfaction with an individual service encounter. They may show that the practical experience of HCBS is diverging from its person-centered design.
The strongest preparation therefore connects grievances with complaints as quality signals. Provider leaders should be able to identify whether the same issue appears in internal complaints, state grievances, incidents, staff feedback, service-plan reviews or participant experience data. States, meanwhile, need governance arrangements that can aggregate those signals without losing the person's individual right to an appropriate response.
Scenario: A Grievance Reveals a Wider Person-Centered Planning Failure
Consider an adult receiving Medicaid-funded HCBS through a fee-for-service arrangement who has repeatedly asked for support to attend community activities in the evening. The person's service plan records community participation as an important goal, but the provider's staffing model is heavily concentrated during daytime hours. The individual is routinely offered activities that fit the provider's schedule instead.
The immediate issue may appear to be a disagreement about scheduling. A mature grievance system would look further. Is the service plan being implemented? Were staffing constraints openly discussed during person-centered planning? Has the person's preference effectively been replaced by organizational convenience? Are similar grievances emerging from other people served by the same provider?
The provider response should not end when one evening shift is arranged. Supervisors may need to review scheduling practices, service-plan fidelity and whether staff understand the difference between documenting a person's goals and organizing support around them. State oversight may need to consider whether the pattern occurs across a provider network or reflects a broader capacity problem.
This is where rights, choice and decision-making intersect with access. The grievance is valuable not merely because it can resolve an individual concern, but because it can reveal whether the operational model supports the rights embedded in HCBS policy.
Incident Management Will Require States to Connect Information That Often Sits Apart
The 2027 incident-management provisions represent another significant change. The Access Rule establishes nationwide minimum expectations for state HCBS incident-management systems, including a minimum definition of critical incidents and requirements around identification, reporting, triage, investigation, resolution, tracking and trending.
Importantly, the model is not limited to incidents voluntarily reported by providers. States are expected, to the extent permitted under applicable law, to use other information sources to help identify critical incidents that may otherwise have gone unreported. Depending on the circumstances and jurisdiction, those sources can involve protective-services information, Medicaid Fraud Control Units, law-enforcement information and other relevant data.
The rule also establishes performance expectations around whether investigations are initiated, incidents are investigated and resolved, and associated corrective actions are completed within state-specified timeframes. This creates a stronger connection between serious-incident governance and measurable system performance.
For providers, the operational implication is substantial. Incident data can no longer be regarded only as an internal risk-management record that is closed once a form, investigation or immediate action is complete. States will increasingly depend on the completeness, timeliness and consistency of provider-originated information while also comparing it with wider sources.
That makes data integrity a safeguarding issue. If incident categories are interpreted differently between sites, timestamps are unreliable, corrective actions are recorded without verification, or an external investigation cannot be reconciled with the provider's record, the problem affects both regulatory reporting and the state's ability to understand risk.
Organizations reviewing these arrangements can use the Quality Improvement Action Plan Builder to strengthen the connection between an identified problem, accountable action, implementation evidence and verification. The critical distinction is between recording that an action was assigned and demonstrating that the underlying risk actually changed.
Scenario: A Critical Incident Exposes a Broken Information Chain
A person with intellectual and developmental disabilities receives residential and community support from a provider operating across several counties. After an unexplained injury, staff follow the provider's incident process and the concern is referred externally. The immediate protection plan is strengthened, but weeks later the provider's quality team cannot establish whether the external investigation has concluded. The local service record still shows the incident as awaiting information.
Under a stronger incident-management model, this cannot simply disappear into an interagency gap. The state needs mechanisms for information sharing when another entity investigates and a way to identify when resolution information has not returned within the required timeframe. The provider needs an escalation route that distinguishes responsibility for the external investigation from its continuing responsibility for the person's safety and its own quality controls.
The case also becomes analytically important. Similar unexplained injuries have occurred in two other services, although each was initially treated separately. Bringing the records together reveals common overnight staffing instability and inconsistent supervision of newer DSPs. The organizational response therefore moves from individual incident closure to workforce and service-level remediation.
The stronger evidence is not three completed incident forms. It is evidence that risks were identified across locations, staffing and supervision were changed, implementation was checked and subsequent incident patterns were monitored. That is the difference between incident reporting and organizational learning.
Access Reporting Will Test Whether Authorized Services Actually Reach People
One of the most consequential features of the Access Rule is its attempt to make HCBS access more measurable. Beginning in 2027, applicable reporting includes information on waiting lists for Section 1915(c) waiver programs and relevant Section 1115 demonstrations, together with measures addressing service-delivery timeliness for specified HCBS.
For waiting lists, the issue is not simply the number of names recorded. States are expected to report information about how lists are maintained, how many people are waiting and how long people newly enrolled in waiver programs had waited. This can expose important differences between apparent demand and actual access, although comparisons will still require careful interpretation because waiver design, eligibility processes and waiting-list methodologies vary among states.
For homemaker, home health aide, personal care and habilitation services, access reporting reaches further into delivery. States are expected to report the average time between initial approval and service commencement for newly approved recipients and the percentage of authorized service hours actually provided. That second measure is especially important.
An authorization is not the same as access. A person may have approval for 30 hours of personal care each week while receiving materially fewer hours because a provider cannot recruit staff, shifts repeatedly go uncovered or rural travel makes the package difficult to sustain. Historically, administrative systems could show the benefit as authorized while the person's lived experience was continuing unmet need.
The new reporting architecture increases the importance of data collection and data quality. States will need defensible definitions, reliable source systems and methods for identifying anomalies. Providers need to understand whether scheduling, electronic visit verification, billing and service records tell the same story.
A useful performance view should therefore connect authorization, scheduling, delivery, cancellation, vacancy and outcome information rather than treating each dataset independently. The Quality Dashboard Builder can help leadership teams structure this type of multidimensional oversight, but the dashboard is only as credible as the definitions and source data behind it.
Scenario: Ninety-Five Percent of Hours Authorized, but Only Seventy-Eight Percent Delivered
A state identifies a region in which personal-care authorizations appear broadly stable but the proportion of authorized hours actually delivered is substantially lower than expected. Provider billing alone does not explain why. Further review shows a combination of DSP vacancies, short-notice callouts, long rural travel distances and packages that providers accepted before confirming sustainable staffing.
The initial temptation is to frame the result as provider nonperformance. That may be appropriate in individual cases, but the state also needs to understand the system conditions. Are payment rates sufficient to sustain recruitment? Are providers being pressured to accept referrals without capacity? Is authorization fragmented into schedules that are difficult to staff? Are rural areas experiencing a materially different problem from metropolitan areas?
A mature response combines provider accountability with system analysis. Individual organizations should demonstrate how they forecast capacity, communicate uncovered hours, escalate persistent shortfalls and keep people informed. The state should use the aggregate evidence to examine network sufficiency, geographic variation, rate design and whether authorization practices contribute to the gap.
For the person receiving support, the distinction is concrete. An authorized hour that is never staffed cannot assist with getting out of bed, preparing food, going to work or participating in the community. Access reporting becomes meaningful only when administrative measures remain connected to those human consequences.
Person-Centered Planning Is Becoming More Measurable
The Access Rule also strengthens oversight of person-centered service planning. Beginning in 2027, states are expected to report and meet a 90% minimum performance level relating to timely reassessment of functional need and updating service plans following reassessment for relevant beneficiaries continuously enrolled for the specified period.
This matters because person-centered planning can otherwise become administratively complete but operationally weak. A reassessment can occur on time while important changes in health, communication, behavior, caregiver capacity or community goals are poorly translated into the service plan. A plan can be updated while frontline staff remain unaware of what changed.
Providers should therefore avoid preparing only for the measurable threshold. Strong person-centered planning requires traceability from reassessment to decision, plan change, staff understanding and actual support. States and plans should similarly consider whether their monitoring can distinguish a timely document from a meaningful planning process.
For people receiving services, the strongest test remains whether the plan reflects their priorities and changes when their lives change. Compliance data can create visibility, but it should not turn person-centered planning into a production target in which timeliness displaces quality.
The 80% Requirement Is Important, but It Should Not Dominate the Entire Rule
The requirement attracting the greatest attention is the HCBS payment-adequacy minimum performance level. Beginning in 2030, states generally must ensure that at least 80% of Medicaid payments for homemaker, home health aide and personal care services are spent on compensation for the direct-care workers furnishing those services, subject to the rule's defined framework, flexibilities and exemptions.
The long runway matters. This is not an 80% requirement that providers suddenly need to meet in 2026. Nor should the provision be simplified into a claim that every HCBS provider must direct 80% of every Medicaid dollar to wages. The regulatory framework identifies particular services, defines relevant payment and compensation concepts and includes state options relating to qualifying small providers and hardship circumstances, as well as specified exemptions.
Habilitation also requires careful treatment. It is included within certain payment-adequacy reporting requirements, but the 80% minimum performance requirement itself applies to homemaker, home health aide and personal care services. Providers operating multiple service lines therefore need more precision than a single organization-wide percentage.
Preparation starts before 2030 because payment-adequacy reporting develops earlier. States first need readiness to collect the required information, followed by reporting on the proportion of relevant payments spent on direct-care compensation. That progression is intended to create visibility before the minimum performance level becomes applicable.
The strategic issue is therefore funding and payment design, not merely payroll classification. States need to understand whether rates can support direct-care compensation while sustaining supervision, training, scheduling, quality systems, technology, insurance, administration and other infrastructure necessary for safe services. Providers need sufficiently granular financial data to explain how Medicaid revenue flows through their operating model.
Payment Adequacy Will Put Provider Economics Under Greater Scrutiny
The policy objective behind the compensation requirement is closely connected to access. HCBS cannot be delivered at scale without a viable direct-care workforce, and chronic recruitment and retention problems can convert an authorized benefit into an unavailable service. Directing a substantial proportion of relevant Medicaid payments toward worker compensation is intended to strengthen that connection.
Yet implementation requires nuance. Provider cost structures differ. Small organizations may have less ability to spread fixed administrative costs. Rural providers may face substantial travel and supervisory costs. Organizations supporting people with higher acuity may require additional clinical oversight, training or operational infrastructure. State rate methodologies also vary significantly.
The final rule therefore contains flexibilities including state options, subject to specified processes and reporting, for hardship exemptions and separate performance levels for qualifying small providers, together with pathways intended to move toward the general requirement. Those provisions do not remove the need for preparation. They make accurate provider-level cost intelligence more important.
Providers should be able to distinguish at least four questions:
- Which Medicaid payments and service categories fall within the applicable reporting or minimum-performance provisions?
- Which forms of direct-care worker compensation qualify under the regulatory framework?
- Can financial, payroll and service-delivery systems produce a consistent and auditable calculation?
- What would different compensation thresholds mean for workforce stability, quality infrastructure and organizational sustainability?
This is where provider financial sustainability becomes inseparable from access policy. A state cannot understand the effect of its payment design by looking only at the nominal Medicaid rate. It needs to understand whether providers can convert that rate into stable workforce capacity and reliable service delivery.
Scenario: Preparing for 2030 Starts With Understanding the Cost Model Now
A home-care provider receives Medicaid revenue for personal care alongside revenue from other programs. Its accounts show total workforce costs, but they do not cleanly attribute eligible direct-care compensation to each Medicaid service stream. Supervisory staff sometimes provide direct care, benefits are accounted for centrally and several administrative functions support both Medicaid and non-Medicaid services.
If leadership waits until the minimum performance level is imminent, it may discover that the problem is not simply changing expenditure. It is reconstructing years of financial architecture. The provider therefore begins earlier by mapping service revenue, worker roles, compensation categories and cost allocation. It models the implications of alternative state methodologies without assuming that every cost will ultimately be treated in a particular way.
The exercise also reveals something operationally useful: turnover is highest in geographic areas where travel time and fragmented schedules make effective earnings least competitive. Management combines its financial analysis with workforce retention intelligence and service-delivery data. The organization can now show the state not merely that costs are increasing, but how workforce economics affect uncovered hours and continuity.
This is stronger preparation than treating 2030 as a future compliance problem. It gives the provider evidence for rate discussions, workforce planning and operational redesign while allowing state leaders to understand how payment policy translates into actual capacity.
Quality Reporting Will Add Another Layer of Public Accountability
The Access Rule also moves HCBS toward more standardized quality reporting. States are required to report every other year on the HCBS Quality Measure Set beginning in 2028. CMS is responsible for maintaining and updating the measure set within the regulatory framework, creating a more consistent national foundation for examining HCBS quality while still operating across highly varied state programs.
Standardization has clear advantages. HCBS has historically been difficult to compare because populations, authorities, measures and reporting systems vary. More consistent measures can improve oversight and make disparities or persistent quality problems more visible. Public reporting can also strengthen accountability to people receiving services, families, advocates and policymakers.
But standardized measurement introduces its own governance responsibilities. A measure can be technically valid while still being misunderstood. Statewide averages can hide geographic, racial, disability-related or provider-level variation. Data can arrive too late to support operational intervention. Differences in source-system completeness can create apparent performance differences that partly reflect measurement rather than practice.
States therefore need data governance and information accountability alongside reporting capability. Providers need to know which source records feed measures, who owns data quality, how anomalies are challenged and how performance information reaches teams capable of changing practice.
Public Transparency Will Change the Relationship Between Data and Assurance
A recurring theme across the Access Rule is transparency. Waiting-list information, access measures, quality information and other required HCBS data are intended to become more visible. This means data previously understood primarily by Medicaid program administrators may increasingly inform public scrutiny, legislative oversight, advocacy, provider conversations and system planning.
For state leaders, publication should not be treated as the final step in reporting. The more important governance question is what happens when public information identifies persistent underperformance. If authorized hours repeatedly go undelivered in one region, who owns the response? If critical-incident performance misses required thresholds, what remediation follows? If reassessment measures are strong but grievances suggest people do not experience services as person-centered, how are the signals reconciled?
Provider boards face similar questions. They should not wait for state publication to discover that their service delivery, incidents or workforce patterns are deteriorating. Mature organizations need an internal assurance rhythm capable of identifying the same issues earlier.
The Governance Maturity Assessment can support boards and executive teams in examining whether accountability, escalation and assurance arrangements are sufficiently developed for this environment. The critical question is not whether leaders receive a dashboard, but whether they can understand variation, challenge weak evidence and require action when performance repeatedly falls short.
Providers Should Prepare for the Rule as an Integrated Operating Model
The weakest implementation response would divide the Access Rule into unrelated projects: a grievance project, an incident project, an access-reporting project, a quality project and a finance project. That may satisfy organizational structures, but the underlying risks overlap.
Undelivered hours may generate grievances. Undelivered support can contribute to health deterioration or incidents. Workforce vacancies may explain access failure. Inadequate rates may contribute to vacancies. Poor incident data may obscure the consequences. Weak person-centered planning may mean the service model no longer reflects what the person needs. The rule becomes more useful when these connections remain visible.
Providers should therefore develop an integrated evidence architecture. That does not require one enormous technology platform. It requires agreement about definitions, ownership and escalation so that information from scheduling, electronic visit verification, payroll, incidents, complaints, service plans, quality reviews and finance can be reconciled when necessary.
A mature operating model would normally be able to demonstrate:
- how authorized services are translated into deliverable schedules and how persistent shortfalls are escalated;
- how grievances, complaints and participant feedback influence service and organizational improvement;
- how critical incidents move from immediate response through investigation, corrective action and verified learning;
- how reassessment leads to meaningful service-plan change and frontline implementation;
- how direct-care workforce and compensation information connects with capacity, continuity and provider sustainability; and
- how executives and boards receive assurance about both regulatory performance and people's actual experience.
The objective is not to build evidence solely for CMS or the state Medicaid agency. It is to make the organization more capable of seeing whether its services are functioning as intended.
State Medicaid Agencies Need to Prepare the Provider Market, Not Just Their Own Systems
Much of the formal regulatory responsibility rests with states, but state compliance will depend heavily on provider capability. A technically sophisticated Medicaid agency cannot produce reliable access measures if providers submit inconsistent service data. An electronic incident-management platform will not solve underreporting if staff do not recognize reportable events. Payment-adequacy reporting will be unstable if providers interpret compensation categories differently.
State implementation therefore needs a provider-readiness dimension. Guidance should be sufficiently clear for organizations of different sizes and technological maturity. Data definitions need testing before high-stakes reporting begins. Technical assistance may need to reach small and rural organizations that do not have large compliance or analytics teams. Managed care arrangements, where used, also need alignment so that providers are not confronted with conflicting definitions or duplicative reporting.
This is particularly important for rural and underserved communities. A reporting framework can identify poor access without itself creating another worker, provider or transportation option. When the data reveals structural scarcity, the response may need to involve rates, workforce strategy, network development, service redesign or alternative delivery arrangements rather than conventional provider remediation alone.
States should also test how new information will influence decisions. Reporting has limited value if the system can describe an access problem annually but has no governance route for changing payment, authorization, provider capacity or program design.
Managed Care Adds Another Accountability Layer
Many HCBS participants receive services within Medicaid managed-care arrangements, but delivery structures vary significantly by state and population. The Access Rule should therefore not be interpreted as creating one uniform managed-care HCBS operating model.
Where MCOs administer relevant services, states need clarity about which functions are delegated, what information plans collect, how provider data reaches the state and how state accountability is retained. Providers need to understand the relationship between federal requirements, state contracts and plan-specific operating processes.
This is particularly important where contract management and provider performance overlap with regulatory reporting. A provider may submit incident, access or workforce information through an MCO while the state remains responsible for demonstrating compliance with federal requirements. Weak interfaces can create duplicate reporting at one end and missing information at the other.
The strongest arrangements therefore define decision rights and data responsibilities before problems occur: who validates provider submissions, who investigates anomalies, who follows persistent service shortfalls, who communicates with the person receiving services and who ensures that corrective action is completed.
The Real Preparation Window Is 2026–2029
The long implementation runway should be understood as a design opportunity. The most visible 2030 provision may be the 80% direct-care compensation requirement, but the years before it create a sequence of tests of whether states and providers can generate reliable information about HCBS.
During 2026 and 2027, grievance infrastructure, incident management, person-centered planning, access reporting and transparency require attention. In 2028, standardized HCBS quality reporting and payment-adequacy reporting increase the evidence burden. In 2029, the electronic incident-management requirement further raises expectations around information infrastructure. By 2030, the direct-care compensation minimum performance level moves payment adequacy from transparency toward a defined performance expectation for the relevant services.
Organizations that treat each year as a separate deadline may repeatedly rebuild systems. Those that use the period to strengthen organizational readiness can create shared infrastructure: stronger data definitions, clearer escalation, better workforce intelligence, more reliable service-delivery evidence and governance that connects regulatory information with operational decisions.
Technology can assist, particularly where data currently sits across disconnected scheduling, EVV, incident, quality and financial systems. But digital investment should follow the operating model rather than substitute for it. The central questions remain what information is needed, who is accountable for its accuracy, what decision follows and how the organization knows whether action improved people's experience.
What Strong Preparation Should Look Like Now
For providers, the immediate priority is not to predict every detail of future state implementation. It is to identify the capabilities that will be necessary under almost any credible implementation model. Reliable service-delivery data, defensible incident processes, meaningful person-centered planning, traceable corrective action, workforce intelligence and sufficiently granular financial information are useful regardless of how individual states operationalize later requirements.
For states, preparation should include more than regulatory drafting and system procurement. Provider engagement, beneficiary involvement, data testing, cross-agency information sharing and analysis of market capacity will determine whether the rule improves access rather than simply improving reporting about poor access.
For boards and executives, the preparation question is equally practical: could the organization explain today why authorized hours are not delivered, where critical incidents recur, whether corrective action worked, how workforce instability affects continuity, and how Medicaid revenue supports the workforce delivering covered services? If those questions cannot be answered reliably, the implementation gap already exists.
The Access Rule therefore creates an opportunity to move from periodic audit and monitoring toward more continuous assurance. The organizations best prepared for later deadlines will not necessarily be those producing the largest volume of compliance material. They will be those able to connect policy, operational data, participant experience, workforce conditions, financial reality and governance into a coherent picture of whether access is actually being achieved.
Conclusion
The Medicaid Access Rule represents a significant shift in how HCBS access, quality, safety and payment are expected to become visible. Its importance lies not in one provision or one deadline, but in the cumulative architecture: grievances that strengthen beneficiary voice, incident systems that expose unresolved risk, access measures that distinguish authorization from actual delivery, standardized quality reporting, greater payment transparency and a longer-term direct-care compensation requirement.
The phased timetable gives states and providers time, but it does not make preparation optional. CMS's 2026 enforcement discretion on FFS grievance systems illustrates that implementation can evolve, making current federal guidance and state-specific direction important. At the same time, the 2027–2030 sequence means organizations already need to understand their data, operating controls, workforce economics and governance weaknesses.
The strongest response will not be to create parallel compliance projects for every provision. It will be to build a more connected HCBS assurance system in which states, plans and providers can see whether people receive the services authorized for them, whether rights and person-centered plans shape delivery, whether serious risks lead to verified improvement and whether payment supports a sustainable direct-care workforce.
Ultimately, the Access Rule will be judged not by the amount of information Medicaid systems publish, but by whether greater transparency and accountability help convert an entitlement on paper into reliable support in people's homes and communities.